fix: pin nebula-pq image to 1.11.0-pq.1, clean up Renovate config (#8)

Replace latest tag on nebula-pq sidecar with explicit 1.11.0-pq.1 to
prevent silent drift on pod restarts. Remove dead dockerfile/rust rule
from Renovate config and add helm-values fileMatch so image tags in
values.yaml are tracked automatically.

Co-authored-by: Larsen Close <lclose@quovis.io>

Author: disentangle-network

helm/disentangle/values.yaml

@@ -95,7 +95,7 @@ nebula:
   enabled: false
   image:
     repository: ghcr.io/disentangle-network/nebula-pq
-    tag: "latest"
+    tag: "1.11.0-pq.1"
     pullPolicy: IfNotPresent
   # Mode: "lighthouse" or "node"
   mode: "node"

renovate.json

@@ -4,7 +4,7 @@
   "packageRules": [
     {
       "matchManagers": ["helm-values"],
-      "matchPackagePatterns": ["disentangle.*"],
+      "matchPackagePatterns": ["disentangle.*", "nebula.*"],
       "automerge": false,
       "labels": ["disentangle-update"]
     },
@@ -15,20 +15,16 @@
       "matchUpdateTypes": ["minor", "patch"],
       "labels": ["helm-deps"]
     },
-    {
-      "matchManagers": ["dockerfile"],
-      "matchPackagePatterns": ["rust"],
-      "groupName": "rust-toolchain",
-      "automerge": true,
-      "matchUpdateTypes": ["minor", "patch"]
-    },
     {
       "matchManagers": ["github-actions"],
       "automerge": true,
       "matchUpdateTypes": ["minor", "patch"],
       "labels": ["ci-update"]
     }
   ],
+  "helm-values": {
+    "fileMatch": ["helm/.+/values\\.yaml$"]
+  },
   "vulnerabilityAlerts": {
     "enabled": true,
     "labels": ["security"]